From c937551e1244e308434e6774bc55da2d71e3c1b4 Mon Sep 17 00:00:00 2001 From: Jason Dillaman Date: Fri, 14 Jun 2019 13:34:24 -0400 Subject: [PATCH] librbd: avoid dereferencing an empty container during deep-copy While updating the image copy progress, a 'while' loop will pop the last item from the queue and then deference the empty queue. Fixes: http://tracker.ceph.com/issues/40368 Signed-off-by: Jason Dillaman (cherry picked from commit 0f491cbb96ec55c68a627de71ed6ccd781a46dcc) --- src/librbd/deep_copy/ImageCopyRequest.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/librbd/deep_copy/ImageCopyRequest.cc b/src/librbd/deep_copy/ImageCopyRequest.cc index bcf9970bf589d..e446c3a5869a1 100644 --- a/src/librbd/deep_copy/ImageCopyRequest.cc +++ b/src/librbd/deep_copy/ImageCopyRequest.cc @@ -143,8 +143,9 @@ void ImageCopyRequest::handle_object_copy(uint64_t object_no, int r) { } } else { m_copied_objects.push(object_no); - while (!m_updating_progress && m_copied_objects.top() == - (m_object_number ? *m_object_number + 1 : 0)) { + while (!m_updating_progress && !m_copied_objects.empty() && + m_copied_objects.top() == + (m_object_number ? *m_object_number + 1 : 0)) { m_object_number = m_copied_objects.top(); m_copied_objects.pop(); uint64_t progress_object_no = *m_object_number + 1; -- 2.39.5